CVE-2024-0763
📋 TL;DR
CVE-2024-0763 is a path traversal vulnerability in Anything-LLM that allows authenticated users to delete arbitrary folders recursively on the server. This affects all users of vulnerable versions who have any level of access to the system, as the endpoint requires authorization but doesn't properly validate file paths.
💻 Affected Systems
- Anything-LLM
📦 What is this software?
Anythingllm by Mintplexlabs
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through deletion of critical system folders, leading to data loss, service disruption, and potential privilege escalation.
Likely Case
Unauthorized deletion of application data, configuration files, or user uploads causing data loss and service disruption.
If Mitigated
Limited impact if proper file permissions and access controls restrict damage to non-critical directories.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 8a7324d0e77a15186e1ad5e5119fca4fb224c39c and later
Vendor Advisory: https://github.com/mintplex-labs/anything-llm/commit/8a7324d0e77a15186e1ad5e5119fca4fb224c39c
Restart Required: Yes
Instructions:
1. Update to latest version of Anything-LLM. 2. Apply commit 8a7324d0e77a15186e1ad5e5119fca4fb224c39c. 3. Restart the application service.
🔧 Temporary Workarounds
Restrict endpoint access
allTemporarily disable or restrict access to the vulnerable folder deletion endpoint
# Configure web server/application firewall to block DELETE requests to vulnerable endpoint
Implement file permission restrictions
linuxSet strict file permissions to limit damage from path traversal
chmod 750 /path/to/application/data
chown root:application /path/to/application/data
🧯 If You Can't Patch
- Implement strict input validation for all file path parameters
- Apply principle of least privilege to application service account file permissions
🔍 How to Verify
Check if Vulnerable:
Check if current version is prior to commit 8a7324d0e77a15186e1ad5e5119fca4fb224c39cCheck Version:
git log --oneline -1Verify Fix Applied:
Verify commit 8a7324d0e77a15186e1ad5e5119fca4fb224c39c is applied and test folder deletion with traversal attempts📡 Detection & Monitoring
Log Indicators:
- Multiple DELETE requests with '../' patterns
- Failed file deletion attempts outside expected directories
- Unusual folder deletion patterns
Network Indicators:
- HTTP DELETE requests containing path traversal sequences
- Unusual volume of file deletion requests
SIEM Query:
source="web_logs" AND method="DELETE" AND (uri="*../*" OR uri="*..\\*")🔗 References
- https://github.com/mintplex-labs/anything-llm/commit/8a7324d0e77a15186e1ad5e5119fca4fb224c39c
- https://huntr.com/bounties/25a2f487-5a9c-4c7f-a2d3-b0527db73ea5
- https://github.com/mintplex-labs/anything-llm/commit/8a7324d0e77a15186e1ad5e5119fca4fb224c39c
- https://huntr.com/bounties/25a2f487-5a9c-4c7f-a2d3-b0527db73ea5
